Splunk App for AWS: Why is all_account_ids.csv not being created?

[cmeo]

It's all in the question 🙂 The app is otherwise up and running quite happily, but all_account_ids.csv did not get created and every input that uses it shows 'Search produced no results'. This is fine as long as I have only one account active, but soon I'll have more.

It seems to me that aws_account_manager.py is supposed to create it, but doesn't. Anyone seen this problem before, and what can I do about it? Manually create with Lookup Editor, or some other way?

Thanks!

[pchen_splunk]

AWS app tries to fill AWS account ID every time when you are in configure page and the account ID is empty. You can try the following steps:

1. Open splunk_app_aws/configure page, check if "Account ID" has value.
2. If not, check all_account_ids.csv in "lookup" folder to see if it records your account ID.
3. It should record your ID, otherwise, you can check splunkd.log and saas_app_aws.log to see if any exceptions popped.

If no account ID and error has been found, you can try to add it manually. You follow steps as czhang posted.

[czhang_splunk]

Hi cmeo,

Basically when you add an AWS account in Configure page of AWS App, the account id will be written into all_account_ids.csv. Have you seen any error when adding AWS account?

A quick and dirty workaround is: go to lookup folder under app dictionary and edit all_account_ids.csv manually.
The file format should be:

> name,account_id
> [your AWS account friendly name],[12-digit AWS account ID]

An example:

> name,account_id
> Calvin,000000000000

It would be great if you could go to Splunk/var/log/splunk/saas_app_aws.log to see if there is any error related to aws_account_manager.py

Hope this helps! Thanks!